direct.gov.uk Domain Breach Exposure Report

The domain direct.gov.uk has experienced a significant exposure event, with 23,949 total incidents recorded between July 2025 and June 2026. The majority of these events, 21,756 (90.8%), are classified as historical data breaches, primarily originating from combolist sources. Additionally, 2,193 (9.2%) incidents are attributed to active infostealer logs, with Redline, Acreed, and LummaC2 being the most prevalent malware families observed. The exposure affects a large number of clients (23,865) and a smaller number of employees (84). The timeline shows a notable increase in employee-related incidents starting in March 2026, coinciding with a surge in client-related events. The high volume of historical data breaches and active infostealer logs, coupled with the large number of affected clients, indicates a substantial risk of credential compromise and potential downstream impacts. The prevalence of common infostealer malware families suggests a broad attack surface. Prioritization should focus on identifying the root cause of the data breaches and infostealer activity, assessing the sensitivity of compromised client and employee data, and implementing robust credential hygiene measures, including multi-factor authentication and regular password rotation, across all affected services, particularly those related to motoring and national careers services.